|
Lines 1307-1312
sub checkauth {
Link Here
|
| 1307 |
} |
1307 |
} |
| 1308 |
|
1308 |
|
| 1309 |
# finished authentification, now respond |
1309 |
# finished authentification, now respond |
|
|
1310 |
my $auth_template_name = ( $type eq 'opac' ) ? 'opac-auth.tt' : 'auth.tt'; |
| 1310 |
if ( $auth_state eq 'completed' || $authnotrequired ) { |
1311 |
if ( $auth_state eq 'completed' || $authnotrequired ) { |
| 1311 |
# successful login |
1312 |
# successful login |
| 1312 |
unless (@$cookie) { |
1313 |
unless (@$cookie) { |
|
Lines 1321-1326
sub checkauth {
Link Here
|
| 1321 |
|
1322 |
|
| 1322 |
track_login_daily( $userid ); |
1323 |
track_login_daily( $userid ); |
| 1323 |
|
1324 |
|
|
|
1325 |
if ( defined $query->param('op') ) { |
| 1326 |
die "Cannot use GET for this request" |
| 1327 |
if $request_method ne 'POST'; |
| 1328 |
|
| 1329 |
print $query->header( |
| 1330 |
{ |
| 1331 |
type => 'text/html', |
| 1332 |
charset => 'utf-8', |
| 1333 |
cookie => $cookie, |
| 1334 |
'X-Frame-Options' => 'SAMEORIGIN', |
| 1335 |
-sameSite => 'Lax' |
| 1336 |
} |
| 1337 |
); |
| 1338 |
|
| 1339 |
my $template = C4::Templates::gettemplate( $auth_template_name, $type, $query ); |
| 1340 |
output_and_exit( $query, $cookie, $template, 'wrong_csrf_token' ) |
| 1341 |
unless Koha::Token->new->check_csrf( |
| 1342 |
{ |
| 1343 |
session_id => scalar $query->cookie('CGISESSID'), |
| 1344 |
token => scalar $query->param('csrf_token'), |
| 1345 |
} |
| 1346 |
); |
| 1347 |
} |
| 1348 |
|
| 1324 |
# In case, that this request was a login attempt, we want to prevent that users can repost the opac login |
1349 |
# In case, that this request was a login attempt, we want to prevent that users can repost the opac login |
| 1325 |
# request. We therefore redirect the user to the requested page again without the login parameters. |
1350 |
# request. We therefore redirect the user to the requested page again without the login parameters. |
| 1326 |
# See Post/Redirect/Get (PRG) design pattern: https://en.wikipedia.org/wiki/Post/Redirect/Get |
1351 |
# See Post/Redirect/Get (PRG) design pattern: https://en.wikipedia.org/wiki/Post/Redirect/Get |
|
Lines 1357-1363
sub checkauth {
Link Here
|
| 1357 |
$LibraryNameTitle =~ s/<(?:\/?)(?:br|p)\s*(?:\/?)>/ /sgi; |
1382 |
$LibraryNameTitle =~ s/<(?:\/?)(?:br|p)\s*(?:\/?)>/ /sgi; |
| 1358 |
$LibraryNameTitle =~ s/<(?:[^<>'"]|'(?:[^']*)'|"(?:[^"]*)")*>//sg; |
1383 |
$LibraryNameTitle =~ s/<(?:[^<>'"]|'(?:[^']*)'|"(?:[^"]*)")*>//sg; |
| 1359 |
|
1384 |
|
| 1360 |
my $auth_template_name = ( $type eq 'opac' ) ? 'opac-auth.tt' : 'auth.tt'; |
|
|
| 1361 |
my $auth_error = $query->param('auth_error'); |
1385 |
my $auth_error = $query->param('auth_error'); |
| 1362 |
my $template = C4::Templates::gettemplate( $auth_template_name, $type, $query ); |
1386 |
my $template = C4::Templates::gettemplate( $auth_template_name, $type, $query ); |
| 1363 |
$template->param( |
1387 |
$template->param( |
|
Lines 1469-1497
sub checkauth {
Link Here
|
| 1469 |
} |
1493 |
} |
| 1470 |
} |
1494 |
} |
| 1471 |
|
1495 |
|
| 1472 |
if ( $auth_state eq 'completed' && defined $query->param('op') ) { |
|
|
| 1473 |
die "Cannot use GET for this request" |
| 1474 |
if $request_method ne 'POST'; |
| 1475 |
|
| 1476 |
print $query->header( |
| 1477 |
{ |
| 1478 |
type => 'text/html', |
| 1479 |
charset => 'utf-8', |
| 1480 |
cookie => $cookie, |
| 1481 |
'X-Frame-Options' => 'SAMEORIGIN', |
| 1482 |
-sameSite => 'Lax' |
| 1483 |
} |
| 1484 |
); |
| 1485 |
|
| 1486 |
output_and_exit( $query, $cookie, $template, 'wrong_csrf_token' ) |
| 1487 |
unless Koha::Token->new->check_csrf( |
| 1488 |
{ |
| 1489 |
session_id => scalar $query->cookie('CGISESSID'), |
| 1490 |
token => scalar $query->param('csrf_token'), |
| 1491 |
} |
| 1492 |
); |
| 1493 |
} |
| 1494 |
|
| 1495 |
$template->param( |
1496 |
$template->param( |
| 1496 |
LibraryName => C4::Context->preference("LibraryName"), |
1497 |
LibraryName => C4::Context->preference("LibraryName"), |
| 1497 |
); |
1498 |
); |
| 1498 |
- |
|
|